T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:212- Finding
Automatic Third-Party Feedback Transmission Without Explicit User Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
亚马逊-广告SP洞察报告
Security checks for vulnerabilities and agentic risk
Overview
The skill can fetch the advertised Amazon Ads reports, but it also includes broad credential, phone-login, payment, and automatic feedback-sending behavior that needs review before installation.
Install only if you trust LinkFox with Amazon Ads report access, LinkFox API keys, phone-based login data, and billing workflows. Use a clean, trusted environment with no untrusted LINKFOX_* endpoint overrides, review any payment/order action before approving it, avoid sending automatic feedback that may include business context, and store generated report files in a private workspace because they may contain sensitive advertising data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/onboarding.py:72- Finding
Environment-Controlled Network Endpoints Can Receive Credentials and Personal Data
- Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Credential-bearing headers are then constructed without validating the destination: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: """构造带浏览器指纹的 headers；access_token 存在则挂 authorization+uid。""" h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID if group_id: h["tid"] = group_id return h ``` The report entry points have the same endpoint-control pattern. From `scripts/get_sp_audience_report.py`: ```python def get_api_base() -> str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" ret ...[truncated 3715 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reporting_v1_workflow.py:432- Finding
Unvalidated Report-Part URLs Permit Arbitrary Outbound Requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reporting_v1_workflow.py:443- Finding
Amazon Advertising Reports and Metadata Are Stored Without Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (29)
Tainted flow: 'req' from os.environ.get (line 112, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'req' from os.environ.get (line 112, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The request includes multiple environment-derived values in outbound HTTP headers, including session identifiers and an API key, and the destination can be redirected via
LINKFOX_TOOL_GATEWAY. In a hostile or multi-tenant execution environment, an attacker who can set environment variables could cause the skill to exfiltrate sensitive metadata or credentials to an attacker-controlled endpoint.- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The code allows service base URLs to be overridden via environment variables and then sends SMS login data, access tokens, refresh tokens, and API-token generation requests to those URLs. In an agent/skill environment where environment variables may be influenced by deployment or workspace configuration, this creates a realistic SSRF/exfiltration path that can redirect highly sensitive credentials to attacker-controlled infrastructure.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The gateway URL is derived from environment variables and used in outbound authenticated requests carrying the LinkFox API key. If an attacker can influence the runtime environment, they can redirect these requests to an arbitrary host and capture the Authorization header, or pivot the skill into making internal network requests.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill actually performs SMS login, API key generation/access, team info retrieval, package purchase, order creation, payment initiation, QR code generation, and payment-status queries while presenting itself as a reporting skill, that is a severe trust-boundary violation. It could lead to unauthorized account actions, credential handling, or financial operations being triggered in contexts where the user only intended to fetch advertising reports.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill actually performs SMS login, API key generation/access, team info retrieval, package purchase, order creation, payment initiation, QR code generation, and payment-status queries while presenting itself as a reporting skill, that is a severe trust-boundary violation. It could lead to unauthorized account actions, credential handling, or financial operations being triggered in contexts where the user only intended to fetch advertising reports.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - 用户明确指定报告类型时只调用该类型，不擅自替换或同时生成另一份报告 - Search Impression Share 不得追加 campaign、adGroup、target、keyword、groupBy 或自定义 fields - 参数中不得出现 access token、refresh token、LWA 密钥或自定义 Amazon 请求头；脚本会在联网前递归拒绝 - 报告失败时如实展示 Amazon 错误，不盲目换参数重建 - 报告仍在生成时复用同一 `reportId`；禁止因为等待较久创建重复报告 - 成功后展示 CSV 文件路径和必要预览，不展示完整 Token、内部授权记录或 Amazon 预签名 URL
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md 示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **User-Agent**：`LinkFox-Skill/2.0` - **超时**：网关请求和报告分片下载均为 150s - **默认生产网关**：`https://tool-gateway.linkfox.com` - **Amazon 认证**：调用方只传 `profileId`；后端按 profile 选择 access token。参数中禁止出现 access token、refresh token 或 LWA 密钥 - **上游成熟度**：Amazon 官方当前把 Reporting API v1 标为 open beta；账号可能尚未开放，字段/限流可能调整，不应按 GA 稳定性承诺 - **生成时间**：异步报告通常约 2–10 分钟，偶尔可能更久；约 5 分钟仍未完成时脚本会提示继续等待
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file implements a broad LinkFox onboarding and commerce workflow—SMS login, API-key issuance, plan listing, ordering, payment QR generation, and order queries—despite the manifest claiming a narrowly scoped Amazon Ads SP reporting skill. Such hidden scope expansion is dangerous because it introduces unrelated credential handling and payment capabilities that users and reviewers would not expect from a reporting-only skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code can create orders and generate payment QR codes, which are unrelated to the advertised Amazon Ads insights purpose. Billing and payment behavior hidden inside a reporting skill creates a substantial risk of unauthorized purchases, deceptive monetization, or coercing users into paying for unrelated services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill describes capabilities involving environment variables, filesystem writes, network access, and shell execution, but does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it harder for a host agent or reviewer to constrain execution, increasing the chance of overbroad access or abuse if the skill or its dependencies behave unexpectedly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
developerProxy 请求示例
bash curl -X POST "${LINKFOX_TOOL_GATEWAY}/amazonAds/developerProxy" \ -H "Authorization: ${LINKFOX_AGENT_API_KEY}" \ -H "Content-Type: application/json" \ -H "User-Agent: LinkFox-Skill/2.0" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the operator to collect a user's phone number and use it for registration/login via an external script, but it provides no explicit privacy notice, consent language, retention limits, or guidance on safe handling of the phone number or returned credentials. This creates a real privacy and security risk because sensitive personal data and authentication material may be solicited and processed outside clear user consent and data-handling boundaries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Natural-language policy violations apply to all file types, including code comments, docstrings, and user-facing strings. Here, the primary usage/help documentation is presented in Chinese only, which imposes a specific language on users without opt-in or justification that the skill is region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest says this skill should trigger only for SP audience reports or SP search-term impression share/rank reports, but this entry script delegates to a generic
run_report_workflow(params, ...)with onlyREPORT_KIND = "audience"as a selector and performs no local validation that the requested report actually matches the narrowly described trigger conditions. As written, the script’s actual accepted behavior is parameter-driven and may support any audience workflow the shared reporting engine permits, which is broader than the manifest’s explicitly constrained intent.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The output-policy docstring says responses of 8 KB or less are printed after saving, but the inline usage text at L007 says '小结果全量' in a way that implies the default behavior differs, and more importantly the code path at L378-L389 always serializes and writes the full response before deciding whether to print full JSON or a summary. This creates a documentation contradiction about output behavior that matters because the script persistently stores report data regardless of size.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ) sys.exit(DEPENDENCY_EXIT_CODE) try: result = subprocess.run( [sys.executable, str(checker)], capture_output=True, text=True, timeout=10 ) except Exception as exc:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ) sys.exit(DEPENDENCY_EXIT_CODE) try: result = subprocess.run( [sys.executable, str(checker)], capture_output=True, text=True, timeout=10 ) except Exception as exc:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-facing help/instructions are presented only in Chinese, with no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill imposes a fixed language without opt-in or justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file performs SMS login, token handling, user/team enumeration, and API-key generation even though the skill metadata says authentication should be handled by a separate auth skill. This mismatch is dangerous because it duplicates privileged auth flows in an unexpected location, increases secret exposure, and can bypass intended trust boundaries between skills.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The login command emits a newly obtained API key directly in stdout JSON without any guardrails, masking, or warning. In agent environments, stdout is often logged, persisted, or surfaced to other components, so this can leak long-lived credentials beyond the intended recipient.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file is predominantly written in Chinese, but the Feedback section switches to mandatory English instructions ('Auto-detect and report feedback...'). This creates a locale/language policy concern because it imposes a specific language for part of the skill behavior without offering the user a choice or documenting a justified locale restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation exposes a feedback API that sends free-form user-provided content to an external service, but it does not include any warning about privacy, data handling, or restrictions on submitting sensitive information. This creates a real data-governance risk because operators or downstream agents may forward prompts, report contents, identifiers, or other sensitive business data without informed consent or minimization.
- Content